Computer-readable recording medium, display control method, and information processing device

ABSTRACT

A mail server displays a list of mail addresses of the sources of mails matching with an extraction condition for inappropriate mails, the list being classified into levels which are divided according to the transmission status of mails matching with the extraction condition for each mail address. Then, in response to the selection of one of the mail addresses from the displayed list, the mail server displays the transition of the transmission status of the mails which match with the extraction condition and have the selected mail address.

CROSS-REFERENCE TO RELATED APPLICATION

This application is based upon and claims the benefit of priority of theprior Japanese Patent Application No. 2015-238086, filed on Dec. 4,2015, the entire contents of which are incorporated herein by reference.

FIELD

The embodiments discussed herein are related to a computer-readablerecording medium, a display control method, and an informationprocessing device.

BACKGROUND

As a result of the penetration of the information technology (IT)environment including the Internet, a variety of information is gettingdistributed in the society. Moreover, there is a growing distribution ofinformation using the IT in all types of scenarios such as in businessor in individual interest or taste. The information that is distributedhas a high degree of freedom and varies in the format and contents.

There is some information which if leaked may cause problems; or thereis some information which generates a harmful effect, such as an attackor nastiness, to the persons to which the information is distributed.Thus, there is information posing various risks. Such information isconstantly getting distributed in invisible form via the IT. Moreover,there is a possibility that a controversial action is unknowingly taken,and in some cases such an action leads to a bigger problem or a crimewithout someone realizing. Furthermore, information once let out in thesociety is difficult to take back. In this way, the distribution ofinformation may cause a loss in the reliability of individuals andbusiness enterprises.

In a business enterprise, electronic mails (hereinafter, sometimeswritten as mails) represent an example of the technology used fordistributing information. In recent years, keywords affecting otherpeople or keywords having a high frequency of appearance are registeredin advance, and electronic mails including such keywords are extracted.

Patent Literature 1: Japanese Laid-open Patent Publication No.2005-284454

Patent Literature 2: Japanese Laid-open Patent Publication No.2007-249584

Patent Literature 3: Japanese Laid-open Patent Publication No.2000-132553

SUMMARY

According to an aspect of an embodiment, a non-transitorycomputer-readable recording medium stores therein a display controlprogram that causes a computer to execute a process. The processincludes displaying a list of mail addresses of sources of mailsmatching with an extraction condition for inappropriate mails, the listbeing classified into levels which are divided according to transmissionstatus of mails matching with the extraction condition for each mailaddress; and displaying, in response to selection of one of mailaddresses from the list, transition of transmission status of mailswhich match with the extraction condition and have the selected mailaddress.

The object and advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims.

It is to be understood that both the foregoing general description andthe following detailed description are exemplary and explanatory and arenot restrictive of the invention.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a diagram illustrating an exemplary overall configuration of asystem according to a first embodiment;

FIG. 2 is a functional block diagram illustrating a functionalconfiguration of a mail server according to the first embodiment;

FIG. 3 is a diagram illustrating an example of the information stored ina category database (DB);

FIG. 4 is a diagram for explaining an example of extracting classifiedkeywords according to co-occurrence probability;

FIG. 5 is a diagram for explaining an example of extracting classifiedkeywords according to clustering;

FIG. 6 is a diagram for explaining an example of automatic addition ofkeywords;

FIG. 7 is a diagram for explaining an example of automatic deletion ofkeywords;

FIG. 8 is a flowchart for explaining a flow of operations performedduring a mail classification operation;

FIG. 9 is a flowchart for explaining a flow of a keyword additionoperation;

FIG. 10 is a flowchart for explaining a flow of a keyword deletionoperation;

FIG. 11 is a functional block diagram illustrating a functionalconfiguration of the mail server according to a second embodiment;

FIG. 12 is a diagram for explaining a standard example of risk degreedetermination;

FIG. 13 is a flowchart for explaining a flow of a risk degreedetermination operation;

FIG. 14 is a diagram for explaining a display example of a maildetermination result;

FIG. 15 is a diagram for explaining a display example of a risk degreestatus;

FIG. 16 a diagram for explaining an example of display regarding eachdegree of risk;

FIG. 17 is a diagram for explaining an example of creating a warningmail;

FIG. 18 is a diagram for explaining an example of displaying theappearance status of keywords from a graph;

FIG. 19 is a diagram for explaining an example of displaying thetransition of extraction before and after the updating of the extractioncondition; and

FIG. 20 is a diagram for explaining an exemplary hardware configuration.

DESCRIPTION OF EMBODIMENTS

Preferred embodiments of the present invention will be explained withreference to accompanying drawings. However, the invention is notlimited by the embodiments explained below. Moreover, the embodimentscan be appropriately combined without causing any contradictions.

However, in the technology mentioned above, since it is difficult tomanage the extraction status for each user, it is not possible to takeappropriate measures thereby leading to an increase in complianceviolation.

For example, just by updating the extraction condition, it is notpossible to understand which user is violating the compliance in whatmanner or it is not possible to understand how many employees are beingsubjected to power harassment. For that reason, it is not possible toclamp down on the violator, thereby leading to an increase in complianceviolation.

[a] First Embodiment

Overall Configuration

FIG. 1 is a diagram illustrating an exemplary overall configuration of asystem according to a first embodiment. As illustrated in FIG. 1, thissystem is an in-house electronic mail system in which electronic mailssent by employees 1 of a company are analyzed using a mail server 10 anda notification is sent to a security administrator 5 (hereinafter,sometimes written as administrator).

Each employee 1 accesses the mail server 10 using an electronic devicesuch as a cellular phone or a personal computer, and communicateselectronic mails with the other employees of the company and with peopleoutside of the company. The administrator 5 uses the mail server 10,analyzes the electronic mails sent and received by the employees 1, andgenerates a mail analysis report.

The mail server 10 is a server device that provides various operationsrelated to electronic mails, such as creation, transmission, andreception of electronic mails, to the employees 1. Moreover, the mailserver 10 extracts, from among the target electronic mails fortransmission that are sent by the employees 1, such electronic mailswhich generate a harmful effect, such as an attack or nastiness, to theaddressed person.

For example, the mail server 10 determines whether or not a targetelectronic mail for transmission can be classified in one of thefollowing categories: information leak, mental abuse, power harassment,and sexual harassment. Regarding an electronic mail that can beclassified in one of the categories, the mail server 10 determines thatthe electronic mail is a problematic electronic mail and holds back fromtransmitting the electronic mail, and issues a warning to the person whocreated that electronic mail. On the other hand, regarding an electronicmail that is not classified in any of the categories, the mail server 10determines that the electronic mail is a problem-free electronic mailand sends it to the destination.

Moreover, the mail server 10 analyzes the transmission status ofelectronic mails regarding each mail address, and generates an analysisresult. For example, for each mail address, the mail server 10 countsthe number of sent electronic mails that are classified in one of thecategories of information leak, mental abuse, power harassment, andsexual harassment. Then, the mail server 10 displays the result ofcounting on a display unit such as a display, and outputs the result ofcounting in the form of a report.

Meanwhile, in the first embodiment, although the examples of categoriesinclude information leak, mental abuse, power harassment, and sexualharassment; those is not the only possible categories, and it ispossible to arbitrarily add or modify the categories. Moreover, in thefirst embodiment, although the explanation is given for a case in whichthe outgoing mails are taken into account, that is not the only possiblecase. Alternatively, the incoming mails can be taken into account, orthe outgoing mails as well as the incoming mails can be taken intoaccount.

Device Configuration

FIG. 2 is a functional block diagram illustrating a functionalconfiguration of the mail server 10 according to the first embodiment.As illustrated in FIG. 2, the mail server 10 includes a communicatingunit 11, a memory unit 12, and a control unit 20.

The communicating unit 11 is a processing unit that controls thecommunication with other devices. For example, the communicating unit 11receives the target electronic mails for transmission from theelectronic devices used by the employees 1. Moreover, the communicatingunit 11 sends the target electronic mails for transmission to therespective destinations. Furthermore, the communicating unit 11 receivesan instruction for analysis result from an administrator terminal usedby the administrator 5, and sends the analysis result to theadministrator terminal.

The memory unit 12 is a memory device used in storing the computerprograms executed by the control unit 20 and storing the data used invarious operations performed by the control unit 20. The memory unit 12is a memory or a hard disk, for example. Herein, the memory unit 12 isused to store a dictionary database (DB) 13, a category DB 14, and aclassification result DB 15.

The dictionary DB 13 is a database that, in the case of classifyingelectronic mails, is used to store information related to the wordsextracted from the contents of the electronic mails. For example, thedictionary DB 13 is used to store the following: words of each part ofspeech; a classification dictionary to be used in morphologicalanalysis; and commonly-used coined terms.

The category DB 14 is a database for storing information related to thecategories in which the electronic mails are classified. FIG. 3 is adiagram illustrating an example of the information stored in thecategory DB 14. As illustrated in FIG. 3, the category DB 14 is used tostore the following items in a corresponding manner: category, relevantKWs, excluded KWs, and impermissible KWs.

The item “category” that is stored represents information enablingidentification of the category for classification. The item “relevantKWs” represents the keywords (hereinafter, sometimes written as KWs)such as words that are determined to belong to the correspondingcategory, and are determined to have a relatively high frequency ofusage in the corresponding category. The item “excluded KWs” representsthe keywords having a high frequency of usage in the correspondingcategory, but also represents the keywords having a high frequency ofusage in normal mails that do not belong to any category. The item“impermissible KWs” represents the keywords that define thecorresponding category, and a mail including any impermissible keywordis determined to be the relevant mails regardless of the presence ofother keywords. Herein, the items “relevant KWs” and “excluded KWs” aretargets for a learning operation (described later), while the item“impermissible KWs” is set by the administrator 5.

In the example illustrated in FIG. 3, an electronic mail includingkeywords such as “client company” and “secret” is likely to be used asan electronic mail falling under “information leak”; while an electronicmail including keywords such as “trade secret” is classified in thecategory “information leak”. On the other hand, an electronic mailincluding keywords such as “estimate” is likely to be used as anelectronic mail falling under “information leak” but is determined to bea normal mail.

Meanwhile, the keywords can be managed by associating each keyword withinformation indicating whether the keyword is manually set by theadministrator 5 or is learnt during a learning operation (describedlater). For example, in the category DB 14, each keyword can be storedin a corresponding manner to “initial setting”. For example, a keywordset by the administrator 5 has “Yes” set in “initial setting”.

The classification result DB 15 is a database for storing theclassification result of the target electronic mails for transmissionand for category determination. For example, the classification resultDB 15 is used to store the electronic mails and the classificationresults in a corresponding manner. Alternatively, the classificationresult DB 15 can be used to store the classification result for eachsource mail address or for each destination mail address, or can be usedto store the classification result for each pair of a source mailaddress and a destination mail address.

The control unit 20 is a processing unit that controls the overalloperations of the mail server 10 and is a processor, for example. Thecontrol unit 20 includes a receiving unit 21, a classificationdetermining unit 22, a sending unit 23, and a learning unit 24. Herein,the receiving unit 21, the classification determining unit 22, thesending unit 23, and the learning unit 24 represent examples ofelectronic circuits of the processor or represent examples of processesexecuted by the processor.

The receiving unit 21 is a processing unit that receives electronicmails. More particularly, the receiving unit 21 receives the targetelectronic mails for transmission that are to be sent to thedestinations from the electronic devices used by the employees 1, andoutputs the electronic mails to the classification determining unit 22.

The classification determining unit 22 is a processing unit thatclassifies an electronic mail, which is received by the receiving unit21, according to the information stored in the category DB 14. Moreparticularly, the classification determining unit 22 determines whetherthe electronic mail is classified in any one of the categories ofinformation leak, mental abuse, power harassment, sexual harassment, andnormal mail; and stores the determination result in the classificationresult DB 15.

Meanwhile, the classification determining unit 22 can implement variousclassification methods used in keyword classification or categoryclassification. Given below is an example of the classification method.For example, the classification determining unit 22 extracts the textwritten in the subject and the text written in the main body, andextracts words by referring to the dictionary DB 13 and performingmorphological analysis. Then, the classification determining unit 22classifies the electronic mail depending on which extracted wordcorresponds to which type of keywords. When the extracted words are notclassified in any category, the classification determining unit 22classifies the received electronic mail as a normal mail, and stores acopy of the normal mail along with the classification result in theclassification result DB 15.

For example, if the extracted words include “trade secret”, then theclassification determining unit 22 classifies the concerned electronicmail in the category “information leak” regardless of the status of theother words. In an identical manner, if the extracted words include“goldbricker”, then the classification determining unit 22 classifiesthe concerned electronic mail in the category “power harassment”regardless of the status of the other words.

Meanwhile, consider a case in which there are three words belonging tothe item “relevant KWs” of the category “information leak”, 10 wordsbelonging to the item “relevant KWs” of the category “mental abuse”, twowords belonging to the item “relevant KWs” of the category “powerharassment”, and four words belonging to the item “relevant KWs” of thecategory “sexual harassment”. In that case, the classificationdetermining unit 22 selects the category “mental abuse” having the mostnumber of words and classifies the concerned electronic mail in thecategory “mental abuse”.

Alternatively, consider a case in which there are three words belongingto the item “relevant KWs” of the category “information leak”, 10 wordsbelonging to the item “relevant KWs” of the category “mental abuse”, twowords belonging to the item “relevant KWs” of the category “powerharassment”, and seven words belonging to the item “relevant KWs” of thecategory “sexual harassment”. In that case, the classificationdetermining unit 22 selects the categories “mental abuse” and “sexualharassment” having the number of words equal to or greater than athreshold value (for example, five) and classifies the concernedelectronic mail in the categories “mental abuse” and “sexualharassment”.

If a plurality of categories equal to or greater than a threshold valueis extracted, then the classification determining unit 22 can also usethe number of excluded keywords that are extracted. For example, in thecase in which there are three words belonging to the item “relevant KWs”of the category “information leak”, 10 words belonging to the item“relevant KWs” of the category “mental abuse, two words belonging to theitem “relevant KWs” of the category “power harassment, and seven wordsbelonging to the item “relevant KWs” of the category “sexual harassment;the classification determining unit 22 selects the categories “mentalabuse” and “sexual harassment” having the number of words equal to orgreater than a threshold value (for example, five).

Subsequently, the classification determining unit 22 identifies thatthree excluded keywords of the category “mental abuse” are extracted andthat zero excluded keywords of the category “sexual harassment” areextracted. Although the concerned electronic mail has a lot of wordscorresponding to the category “mental abuse”, many of the same words arealso used in normal mails. Hence, the classification determining unit 22classifies the concerned electronic mail in the category “sexualharassment” having fewer excluded keywords.

Alternatively, the classification determining unit 22 can performclassification using the extraction percentage of the relevant keywordsand the excluded keywords. For example, from among all extracted words,the classification determining unit 22 can identify the category havingthe percentage of the relevant keywords to be equal to or greater than apredetermined value (a threshold value A) and having the percentage ofthe excluded keywords to be equal to or smaller than a predeterminedvalue (a threshold value B); and can accordingly classify the concernedelectronic mail.

The sending unit 23 is a processing unit that sends a receivedelectronic mail to the destination. For example, regarding an electronicmail that has been determined to be a normal mail, the sending unit 23sends that electronic mail to the destination. Moreover, regarding arisky electronic mail that is classified in one of the categoriesspecified in the category DB 14; for example, the sending unit 23 sendsa warning to the sender and sends the electronic mail to the destinationalong with a message such as “please consult with the administrator”.

The learning unit 24 is a processing unit that includes a keywordextracting unit 25, a registering unit 26, and a deleting unit 27; andthat makes use of the constituent elements and learns the various typesof keywords stored in the category DB 14. The learning operation can beperformed on a periodic basis or at arbitrary timings. Herein, thelearning unit 24 performs the learning operation with respect to theelectronic mails stored in the classification result DB 15, that is,with respect to the electronic mails classified in any one of thecategories.

The keyword extracting unit 25 is a processing unit that extractskeywords from an already-classified electronic mail. More particularly,the keyword extracting unit 25 reads an already-classified electronicmail and the corresponding category from the classification result DB15, and extracts keywords from the subject and the body text of thatelectronic mail according to a known method such as co-occurrenceprobability or clustering.

Given below is the explanation of a specific example of keywordextraction. FIG. 4 is a diagram for explaining an example of extractingclassified keywords according to co-occurrence probability. Asillustrated in FIG. 4, the explanation is given with reference to 20electronic mails from a mail 1 to a mail 20 that are classified in thecategory “mental abuse”. As illustrated in FIG. 4, the keywordextracting unit 25 refers to the dictionary DB 13 and extracts keywordsfrom the 20 electronic mails. Herein, from the 20 electronic mails, thekeyword extracting unit 25 excludes such keywords which are alreadyregistered in the item “relevant KWs” of the category “mental abuse”;and considers “banana”, “orange”, and “apple” as candidates forregistration.

In the example illustrated in FIG. 4, since 10 electronic mails out ofthe 20 electronic mails include “banana”, the keyword extracting unit 25calculates the probability of occurrence as “10/20×100=50%”. Similarly,since nine electronic mails out of the 20 electronic mails include“orange”, the keyword extracting unit 25 calculates the probability ofoccurrence as “9/20×100=45%”. Moreover, since seven electronic mails outof the 20 electronic mails include “apple”, the keyword extracting unit25 calculates the probability of occurrence as “7/20×100=35%”.

As a result, the keyword extracting unit 25 extracts “banana”, which hasthe probability of occurrence equal to or greater than a threshold value(50%), as the target keyword for registration.

Given below is the explanation of an example of extracting classifiedkeywords according to clustering. FIG. 5 is a diagram for explaining anexample of extracting classified keywords according to clustering. Asillustrated in FIG. 5, the category “mental abuse” has “fool”, “dumb”,“crap”, “idiot”, and “die” registered as the keywords. In that state,the keyword extracting unit 25 refers to the dictionary DB 13 andextracts “fool”, “dumb”, “crap”, “banana”, “idiot”, “die”, and “apple”from all electronic mails classified in the category “mental abuse”.

Then, with respect to the extracted keywords “fool”, “dumb”, “crap”,“banana”, “idiot”, “die”, and “apple”; the keyword extracting unit 25performs clustering using a learning algorithm that enables learningaccording to synonyms or syntactic dependency. Then, the keywordextracting unit 25 classifies “fool”, “dumb”, “crap” and “banana” in acluster A; and classifies “idiot”, “die”, and “apple” in a cluster B.

As a result, the keyword extracting unit 25 selects the partial sethaving the least number of keywords not appearing in the electronicmail, that is, selects the cluster A having the greater number ofclassified keywords. Then, from among “fool”, “dumb”, “crap”, and“banana” clustered in the cluster A; the keyword extracting unit 25extracts the not-yet-registered “banana” as the target keyword forregistration.

Meanwhile, the keyword extracting unit 25 can either perform anextraction operation according to co-occurrence probability, or performan extraction operation according to clustering, or perform anextraction operation according to both co-occurrence probability andclustering. For example, the keyword extracting unit 25 can determinethe keywords extracted according to either co-occurrence probability orclustering as the target keywords for registration, or can determine thekeywords extracted according to co-occurrence probability as well asclustering as the target keywords for registration.

The registering unit 26 is a processing unit that registers new keywordsin the category DB 14. More particularly, the registering unit 26obtains, from the keyword extracting unit 25, the category forregistration and the keywords to be registered, and registers thekeywords in the item “relevant KWs” of the concerned category. Forexample, if the category “mental abuse” and the keyword “banana” isobtained from the keyword extracting unit 25, then the registering unit26 registers the keyword “banana” in the item “relevant KWs” of thecategory “mental abuse” in the category DB 14. At that time, if thekeyword “banana” falls under the existing excluded keywords of thecategory “mental abuse”, then the registering unit 26 holds back fromregistering that keyword.

FIG. 6 is a diagram for explaining an example of automatic addition ofkeywords. As illustrated in FIG. 6, the keyword extracting unit 25extracts “die” and “dude” as the keywords from an electronic mailinflicting mental abuse. Since the keyword “die” is already registered,the registering unit 26 registers the not-yet-registered keyword “dude”in the item “relevant KWs” of the category “mental abuse”.

Meanwhile, the registering unit 26 can also extract excluded keywordsand newly register them. For example, the registering unit 26 reads suchelectronic mails from the classification result DB 15 which areclassified as normal mails, and extracts keywords from each electronicmail. Then, the registering unit 26 identifies the keywords included ina threshold percentage (for example, 70%) of the normal mails, andregisters the keywords in the item “excluded KWs” of each category inthe category DB 14.

Regarding the target keywords for registration that are extracted by thekeyword extracting unit 25, the registering unit 26 can determinewhether or not each keyword falls under the excluded keywords and, ifthe keyword falls under the excluded keywords, can register the keywordin the item “excluded KWs”. In the example explained above, theregistering unit 26 determines the percentage of normal mails thatinclude the target keyword “banana” for registration as obtained fromthe keyword extracting unit 25. If the percentage of including thetarget keyword “banana” for registration is smaller than a thresholdvalue (for example, 50%), then the registering unit 26 registers thekeyword “banana” in the item “relevant KWs” of the category “mentalabuse” in the category DB 14. On the other hand, if the percentage isequal to or greater than the threshold value, then the registering unit26 registers the keyword “banana” in the item “excluded KWs” of thecategory “mental abuse” in the category DB 14.

The deleting unit 27 is a processing unit that, from among the relevantkeywords stored in the category DB 14, deletes the keywords having a lowfrequency of usage. More particularly, every time the abovementionedlearning operation is performed, the deleting unit 27 counts the numberof appearances of each keyword registered in the item “relevant KWs” ofeach category. Then, the deleting unit 27 deletes such keywords from theitem “relevant KWs” which match with a pre-specified deletion conditionsuch as the keywords having the number of appearances to be continuouslysmaller than a threshold value for a predetermined number of times orthe keywords having the number of appearances to be smaller than athreshold value.

Moreover, when the target relevant keyword for deletion is a keywordhaving the initial setting done by the administrator, the deleting unit27 holds back from deleting that keyword. When the target relevantkeyword for deletion has been learnt in the past during a learningoperation, the deleting unit 27 deletes the keyword. Regarding theexcluded keywords too, the deleting unit 27 can delete the keywordshaving a low frequency of usage in the normal mails in an identicalmanner.

FIG. 7 is a diagram for explaining an example of automatic deletion ofkeywords. As illustrated in FIG. 7, in the item “relevant KWs” of thecategory “mental abuse”, the keyword “dude” has the extraction count of20, the keyword “die” has the extraction count of 35, the keyword “fool”has the extraction count of 9, the keyword “dumb” has the extractioncount of 2, and the keyword “crap” has the extraction count of 16. Inthis case, the deleting unit 27 determines the keywords “fool” and“dumb” having the extraction count to be smaller than a threshold value(10) as the target keywords for deletion. However, since the keyword“fool” has “yes” set in the initial setting, it is excluded from thetargets for deletion. As a result, the deleting unit 27 deletes only thekeyword “dumb” from the item “relevant KWs” of the category “mentalabuse”.

Flow of Operations

Given below is the explanation of a flow of various operations performedin the mail server 10. Herein, the explanation is given about aclassification operation, an addition operation, and a deletionoperation.

Flow of Classification Operation

FIG. 8 is a flowchart for explaining a flow of operations performedduring a mail classification operation. As illustrated in FIG. 8, whenan electronic mail is received by the receiving unit 21 (Yes at S101),the classification determining unit 22 refers to the dictionary DB 13and extracts keywords from the electronic mail (S102).

Then, the classification determining unit 22 compares the extractedkeywords with the category-related information stored in the category DB14, and classifies the electronic mail (S103). Once the electronic mailis classified (Yes at S104), the classification determining unit 22stores the electronic mail and the classification result in theclassification result DB 15 (S105).

On the other hand, when the electronic mail is not classified by theclassification determining unit 22 (No at S104), the sending unit 23determines the electronic mail to be a normal mail and sends it to thedestination (S106). However, regarding a normal mail too, theclassification determining unit 22 stores a copy of the electronic mailand the classification result in the classification result DB 15.

Flow of Addition Operation

FIG. 9 is a flowchart for explaining a flow of a keyword additionoperation. As illustrated in FIG. 9, at the operation start timing (Yesat S201), the keyword extracting unit 25 selects a single category(S202); obtains the electronic mails classified in the selected categoryfrom among the electronic mails stored in the classification result DB15; and extracts registration candidates (candidate type 1) according toco-occurrence probability (S203).

Then, the keyword extracting unit 25 extracts registration candidates(candidate type 2) according to clustering from the electronic mailsclassified in the selected category (S204). Subsequently, using thenormal mails, the registering unit 26 extracts the keywords to beexcluded from the classification targets, that is, extracts the keywordsto be excluded from the registration targets (S205).

Then, the registering unit 26 stores the keywords to be excluded fromthe classification targets as excluded keywords (S206). Moreover, fromthe candidate type 1 and the candidate type 2, the registering unit 26identifies registration candidates (candidate type 3) from whichexcluded keywords are removed (S207).

Subsequently, the registering unit 26 registers the keywords of thecandidate type 3 in the item “relevant KWs” of the selected category(S208). Then, if any unprocessed category is present (Yes at S209), theoperations from S202 onward are performed again. When no unprocessedcategory is present (No at S209), it marks the end of the additionoperation.

Flow of Deletion Operation

FIG. 10 is a flowchart for explaining a flow of a keyword deletionoperation. As illustrated in FIG. 10, at the operation start timing (Yesat S301), the deleting unit 27 selects a single category (S302) andextracts keywords from the electronic mails that are classified in theselected category from among the electronic mails stored in theclassification result DB 15 (S303).

Then, using the keywords extracted from the concerned electronic mails,the deleting unit 27 calculates the number of appearances of thekeywords registered in “category” in the category DB 14 (S304).Subsequently, the deleting unit 27 identifies the keywords having thenumber of appearances to be smaller than a threshold value (S305).

Subsequently, when the identified keywords having the number ofappearances to be smaller than a threshold value include deletablekeywords (Yes at S306), the deleting unit deletes those keywords fromthe item “relevant KWs” in the category DB 14 (S307). That is, fromamong the identified keywords having the number of appearances to besmaller than a threshold value, the deleting unit 27 deletes thekeywords not having the initial setting.

On the other hand, when deletable keywords are not present (No at S306);the system control proceeds to S308. Subsequently, when any unprocessedcategory is present (Yes at S308), the operations from S302 onward areperformed again. When no unprocessed category is present (No at S308),it marks the end of the deletion operation.

Effect

The mail server 10 according to the first embodiment can periodicallylearn the keywords used in each category, and thus can keep a dailytrack of the changes attributed to the changes of the times and thefashion. Thus, as a result of continuously using the same extractioncondition, it is believed that the extraction count goes on decreasing.However, by periodically updating the extraction condition, it ispossible to expect improvement in the extraction count. That enablesmaintaining the extraction accuracy of the electronic mails that violatethe compliance and create an adverse effect.

Moreover, the mail server 10 can focus on the passage of time, capturethe changes, and constantly vary the value (weight) of the keywords.Besides, the mail server 10 can maintain recency and optimality of theextraction condition, and accordingly update and delete the keywords.

Furthermore, the mail server 10 can obtain unique evaluation or peculiarevaluation that is not taken into account in commonly-used keywords, andcan obtain the result in tune with the objective of the users. Moreover,the mail server 10 can perform learning suitable to the users and thuslearn matching keywords for the users, thereby enabling achievingenhancement in the extraction accuracy.

[b] Second Embodiment

Overall Configuration

In addition to the operations explained in the first embodiment, themail server 10 can analyze the mail transmission status of the employees1. In that regard, in a second embodiment, the explanation is given foran example in which the mail server 10 analyzes the degree of risk ofthe electronic mails sent from each mail address. Herein, since theoverall configuration is identical to the first embodiment, thatexplanation is not repeated.

Functional Configuration

FIG. 11 is a functional block diagram illustrating a functionalconfiguration of the mail server 10 according to the second embodiment.As illustrated in FIG. 11, the mail server 10 includes the communicatingunit 11, the memory unit 12, and the control unit 20. However, thedifference from the first embodiment is that a risk degree DB 16, a riskdegree determining unit 30, and a display control unit 31 are included.Thus, in the second embodiment, the explanation is given about the riskdegree DB 16, the risk degree determining unit 30, and the displaycontrol unit 31. Meanwhile, the memory unit 12 is used to store thetarget electronic mails for transmission, that is, to store allelectronic mails received by the receiving unit 21.

The risk degree DB 16 is a database for storing the degree of riskdetermined with respect to each mail address. More particularly, therisk degree DB 16 is used to store the degree of risk, which isdetermined according to an operation described later, for each sourcemail address, for each destination mail address, and for each pair of asource mail address and a destination mail address. Thus, the riskdegree DB 16 is used to store information enabling identification of theusers who send electronic mails causing information leak, mental abuse,power harassment, or sexual harassment.

The risk degree determining unit 30 is a processing unit that determinesthe users who carry a high risk of sending vicious electronic mails.More particularly, for each source mail address, for each destinationmail address, and for each pair of a source mail address and adestination mail address; the risk degree determining unit 30 determinesthe degree of risk according to a predetermined criterion and stores thedetermination result in the risk degree DB 16.

For example, the risk degree determining unit 30 assigns pointsaccording to the number of electronic mails classified in each category.As an example, if two electronic mails are classified in the category“information leak”, the risk degree determining unit 30 assigns twopoints. Similarly, also when two electronic mails are classified in thecategories “information leak” and “sexual harassment”, the risk degreedetermining unit 30 assigns two points. Moreover, if the risk degreedetermination is performed on a Wednesday, then the risk degreedetermining unit 30 performs determination for the first week (1 week)during the three days of Monday, Tuesday, and Wednesday.

Meanwhile, the risk degree determining unit 30 performs determinationnot according to the number of points but according to the rate(points/days). For example, if two points are assigned over the threedays of Monday, Tuesday, and Wednesday; then the risk degree determiningunit 30 calculates “2/3=0.66660.67”.

Given below is the explanation of a standard example of risk degreedetermination. FIG. 12 is a diagram for explaining a standard example ofrisk degree determination. As illustrated in FIG. 12, each degree ofrisk has determination criteria set therefor. Herein, the degree of risk5 is assumed to be the highest. Although each degree of risk is set witha plurality of determination conditions, the conditions either can be ORconditions or can be AND conditions, and can be set in an arbitrarymanner. Herein, the explanation is given for the case of OR conditions.

As illustrated in FIG. 12, the risk degree determining unit 30determines that the mail addresses satisfying the following criterionhave the degree of risk 5: “(the point rate in the determinationweek)≥1.5”, or “(the point rate four weeks ago)≥1.4 and (the point ratethree weeks ago)≥1.4 and (the point rate two weeks ago)≥1.4 and (thepoint rate one week ago)≥1.4”.

Moreover, the risk degree determining unit 30 determines that the mailaddresses satisfying the following criterion have the degree of risk 4:“(the point rate four weeks ago)+(the point rate three weeks ago)+(thepoint rate two weeks ago)+(the point rate one week ago)≥4.2”. In anidentical manner, the risk degree determining unit 30 determines thatthe mail addresses satisfying the following criterion have the degree ofrisk 4: “(the point rate four weeks ago)+(the point rate three weeksago)+(the point rate two weeks ago)+(the point rate one week ago)≥3.6”and “classified into two or more categories over the four weeks”.Moreover, the risk degree determining unit 30 determines that the mailaddresses satisfying the following criterion have the degree of risk 4:“(the point rate in the determination week)≥1.0”. Furthermore, the riskdegree determining unit 30 determines that the mail addresses satisfyingthe following criterion have the degree of risk 4: “(the point rate fourweeks ago)≥0.8 and (the point rate three weeks ago)≥0.8 and (the pointrate two weeks ago)≥0.8 and (the point rate one week ago)≥0.8”.

The risk degree determining unit 30 determines that the mail addressessatisfying the following criterion have the degree of risk 3: “(thepoint rate four weeks ago)+(the point rate three weeks ago)+(the pointrate two weeks ago)+(the point rate one week ago)≥2.4”. In an identicalmanner, the risk degree determining unit 30 determines that the mailaddresses satisfying the following criterion have the degree of risk 3:“(the point rate four weeks ago)+(the point rate three weeks ago)+(thepoint rate two weeks ago)+(the point rate one week ago)≥1.8” and“classified into two or more categories over the four weeks”. Moreover,the risk degree determining unit 30 determines that the mail addressessatisfying the following criterion have the degree of risk 3: “(thepoint rate in the determination week)≥0.5”.

The risk degree determining unit 30 determines that the mail addressessatisfying the following criterion have the degree of risk 2: “(thepoint rate four weeks ago)+(the point rate three weeks ago)+(the pointrate two weeks ago)+(the point rate one week ago)≥1.2”. In an identicalmanner, the risk degree determining unit 30 determines that the mailaddresses satisfying the following criterion have the degree of risk 2:“(the point rate in the determination week)≥0.3”.

The risk degree determining unit 30 determines that the mail addressessatisfying the following criterion have the degree of risk 1: “(thepoint rate four weeks ago)+(the point rate three weeks ago)+(the pointrate two weeks ago)+(the point rate one week ago)≥0.1”. In an identicalmanner, the risk degree determining unit 30 determines that the mailaddresses satisfying the following criterion have the degree of risk 1:“(the point rate in the determination week)>0.0”.

Regarding the mail addresses not satisfying any of the determinationcriteria given above, the risk degree determining unit 30 determinesthat the corresponding electronic mails have the degree of risk 0, thatis, the corresponding electronic mails are normal mails.

The display control unit 31 is a processing unit that displays a varietyof information, and performs display control according to the useroperations performed by the administrator 5. More particularly, thedisplay control unit 31 displays, on a display, or sends, to theadministrator terminal, the following: the display of mail addresses ateach degree of risk; the transition of the mail transmission status foreach mail address; and the transition of mail classification before andafter category learning.

Moreover, the display control unit 31 can obtain, from the learning unit24, the learning result of the learning explained in the firstembodiment and the result of various operations performed up to thelearning; and can display the obtained information. For example, thedisplay control unit 31 can count, for each mail address, the extractioncount of each relevant keyword of each category and display the countingresult. Meanwhile, regarding the counting result, the learning unit 24can obtain the counting result, or the display control unit 31 canobtain perform counting from the various operation results in thelearning operation.

Flow of Risk Degree Determination Operation

FIG. 13 is a flowchart for explaining a flow of a risk degreedetermination operation. As illustrated in FIG. 13, at the operationstart timing (Yes at S401), the risk degree determining unit 30 selectsone of the mail addresses stored in the classification result DB 15(S402).

Then, regarding the selected mail address, the risk degree determiningunit 30 refers to the classification result DB 15 and calculates thepoint rate of the recent one week (S403) and calculates the total pointrate of the past four weeks (S404). At that time, the risk degreedetermining unit 30 also calculates the concerned category count in thedetermination week and the concerned category count over the past fourweeks.

When the point rate and the category count satisfy the determinationcriterion for the degree of risk 5 (Yes at S405), the risk degreedetermining unit 30 determines that the selected mail address has thedegree of risk 5 (S406), and the system control proceeds to S416.

However, when the point rate and the category count do not satisfy thedetermination criterion for the degree of risk 5 (No at S405) butsatisfy the determination criterion for the degree of risk 4 (Yes atS407), the risk degree determining unit 30 determines that the selectedmail address has the degree of risk 4 (S408), and the system controlproceeds to S416.

When the point rate and the category count do not satisfy thedetermination criterion for the degree of risk (No at S407) but satisfythe determination criterion for the degree of risk 3 (Yes at S409), therisk degree determining unit 30 determines that the selected mailaddress has the degree of risk 3 (S410), and the system control proceedsto S416.

When the point rate and the category count do not satisfy thedetermination criterion for the degree of risk 3 (No at S409) butsatisfy the determination criterion for the degree of risk 2 (Yes atS411), the risk degree determining unit 30 determines that the selectedmail address has the degree of risk 2 (S412), and the system controlproceeds to S416.

When the point rate and the category count do not satisfy thedetermination criterion for the degree of risk (No at S411) but satisfythe determination criterion for the degree of risk 1 (Yes at S413), therisk degree determining unit 30 determines that the selected mailaddress has the degree of risk 1 (S414), and the system control proceedsto S416.

When the point rate and the category count do not satisfy thedetermination criterion for the degree of risk (No at S413), the riskdegree determining unit 30 determines that the selected mail addressdoes not have any degree of risk (S415). Then, if any unselected mailaddress is present (Yes at S416), the risk degree determining unit 30again performs the operations from S402 onward. When no unselected mailaddress is present (No at S416), it marks the end of the operations.

Specific Examples of Display Control

Explained below with reference to FIGS. 14 to 19 are display examplesdisplayed by the display control unit 31. Meanwhile, the display controlunit 31 can every time obtain the risk degree determination result fromthe risk degree determining unit 30 and the learning result from thelearning unit 24, and store the results in the memory unit 12.

Mail Determination Result

FIG. 14 is a diagram for explaining a display example of a maildetermination result. As illustrated in FIG. 14, when a displayinstruction for displaying the determination result of electronic mailsis received, the display control unit 31 can count the risk degreedetermination results and the learning results for the user-specifiedperiod and display the counting result.

For example, as illustrated in FIG. 14, the display control unit 31displays the extraction count of the extracted keywords (the relevantkeywords, the excluded keywords, and the impermissible keywords) of eachcategory over a specified period of time from Nov. 10, 2015 to Dec. 11,2015 (see A in FIG. 14). Moreover, as a result of counting theextraction count of each extracted keyword over the specified period oftime from Nov. 10, 2015 to Dec. 11, 2015, the display control unit 31can calculate the total extraction count of the extracted keywords ofeach category and display a line graph for each category so as todisplay the status transition of the extraction count (see B in FIG.14). Moreover, the display control unit 31 can display the details ofthe line graphs in a pie chart (see C in FIG. 14).

Risk Degree Status

FIG. 15 is a diagram for explaining a display example of the risk degreestatus. As illustrated in FIG. 15, when a display instruction fordisplaying the risk degree status is received, the display control unit31 can display the latest risk degree determination result. Apart fromdisplaying the latest risk degree determination result, the displaycontrol unit 31 can also display the determination results for thespecified period in the past, and can also display the transition of thedetermination results.

For example, as the determination result of the latest determinationdate (Dec. 12, 2015), the display control unit 31 can display the riskdegree status indicating the degree of risk, the source mail address,and the determination transition in a corresponding manner (see D inFIG. 15). The determination transition represents information indicatingwhether or not the degree of risk has increased as compared to theprevious instance. When the degree of risk has increased as compared tothe previous instance, an upward arrow is displayed. When the degree ofrisk has decreased as compared to the previous instance, a downwardarrow is displayed. When the degree of risk has not changed since theprevious instance, a horizontal arrow is displayed.

Moreover, when the selection of a mail address displayed in the riskdegree status is extracted, the display control unit 31 can also displaya line graph indicating the transition of the category classificationresult (the category classification count) over the period of time (fromNov. 10, 2015 to Dec. 11, 2015) treated as the target for determinationaccording to the determination date (Dec. 12, 2015) (see E in FIG. 15).Meanwhile, instead of displaying the category classification result, thedisplay control unit 31 can display the body text of the concernedelectronic mail. Herein, although the explanation is given withreference to the source mail addresses, identical operations can also beperformed with respect to the destination mail addresses or with respectto pairs of source mail addresses and destination mail addresses.

Risk Degree Display

FIG. 16 a diagram for explaining an example of display regarding eachdegree of risk. As illustrated in FIG. 16, upon receiving an instructionfor displaying the degree of risk, the display control unit 31 candisplay a list of concerned mail addresses corresponding to each degreeof risk according to the latest risk degree determination result. Apartfrom displaying the latest risk degree determination result, the displaycontrol unit 31 can also display the determination results for thespecified period in the past.

In the example illustrated in FIG. 16, the display control unit 31displays a screen in response to the selection of the tab of the degreeof risk 5, and displays a list of source mail addresses, a list ofdestination mail addresses, and a source-destination list correspondingto the degree of risk 5. When a tab change is received, the displaycontrol unit 31 changes the display to the list of addressescorresponding to another degree of risk.

When a mail address is selected in this state, the display control unit31 can also automatically create and send a warning mail. FIG. 17 is adiagram for explaining an example of creating a warning mail. Asillustrated in FIG. 17, when a source mail address “aaaaaaa@bbb.com”determined to have the degree of risk 5 is selected, the display controlunit 31 automatically generates a warning mail addressed to“aaaaaaa@bbb.com”.

The body text of the created warning mail can be automatically variedaccording to the degree of risk, the mail address, and theclassification status. For example, higher the degree of risk, thehigher is the possibility of violating a law. Hence, the display controlunit 31 creates the contents issuing a more severe warning. As anexample, regarding the degree of risk 5, the display control unit 31creates contents indicating measures such as taking a legal action orarranging a meeting. In contrast, regarding the degree of risk 1, thedisplay control unit 31 creates contents prompting precautions in theusage of words.

With respect to a source mail address, the display control unit 31creates a warning message as explained above. With respect to adestination mail address, the display control unit 31 creates a messagehaving the contact information of the administrator 5 or theconsultation desk and prompting consultation. With respect to acombination of addresses, the display control unit 31 creates a messageabout scheduling a dialogue between the two concerned persons along witha third party.

Meanwhile, the display control unit 31 can also create various messageswith respect to the category having the highest category classificationcount with respect to the selected mail addresses. Moreover, the displaycontrol unit 31 can also create a warning mail for each category forwhich the category classification count with respect to the selectedmail addresses exceeds a threshold value. Even when a mail addressspecified in the risk degree status illustrated in FIG. 15 (see E inFIG. 15) is selected, the display control unit 31 can create a warningmail.

Appearance Status

FIG. 18 is a diagram for explaining an example of displaying theappearance status of keywords from a graph. As illustrated in FIG. 18,when any one line graph is selected from among the line graphsrepresenting the status transition of the category-by-categoryextraction counts (see B in FIG. 14), the display control unit 31 candisplay the extraction count of each extracted keyword of each category.

In the example illustrated in FIG. 18, when the selection of the graphregarding the category “mental abuse” is extracted, the display controlunit 31 displays the extraction count of each keyword of the category“mental abuse”. In an identical manner, when the selection of the graphregarding the category “information leak” is extracted, the displaycontrol unit 31 displays the extraction count of each keyword of thecategory “information leak”. Meanwhile, the extraction count displayedherein is the count of extraction taken within the specified period oftime displayed in the graph of status variation.

Transition of Extraction Before and After Learning

FIG. 19 is a diagram for explaining an example of displaying thetransition of extraction before and after the updating of the extractioncondition. As illustrated in FIG. 19, in the line graphs indicating thestatus transition of the category-by-category extraction counts (see Bin FIG. 14), the display control unit 31 puts the dates on which therelevant keywords representing the extraction condition are updated as aresult of performing the learning operation explained in the firstembodiment.

In the example illustrated in FIG. 19, it is displayed that theextraction condition is updated on the dates May 10 and September 10. Asa result of performing such display, the transition of the extractioncounts can be understood before and after the updating of the extractioncondition. For example, in the example illustrated in FIG. 19, prior tothe updating of the extraction condition, the extraction count isdecreasing for each category. However, after the updating of theextraction condition, the extraction count is increasing. That isbecause of the following reason. The keywords used in each categorychange on a daily basis due to the changes of the times and the fashion,and the violators also learn on a daily basis. Hence, as a result ofcontinuously using the same extraction condition, the extraction countgoes on decreasing. As a result, if the extraction condition is updatedon a periodic basis, it becomes possible to follow the learning of theviolators, and an improvement in the extraction count can be expected.

Meanwhile, when the period prior to the updating of the extractioncondition is selected, the display control unit 31 displays thepre-updating extraction condition. When the period after the updating ofthe extraction condition is selected, the display control unit 31displays the post-updating extraction condition. Moreover, in thepost-updating extraction condition, the display control unit 31 can alsodisplay the deleted keywords or the added keywords.

Effect

The mail server 10 according to the second embodiment can display thelearning result and the degree of risk. That enables understanding ofthe transmission status of the electronic mails causing complianceviolation, and the administrator can visually understand the degrees ofrisk and the risky users. Moreover, since the mail server 10 can provideinterface of various perspectives, it leads to the enhancement inuser-friendliness.

Furthermore, since the mail server 10 can display the periodic updatingperiod of the extraction condition along with the classificationtransition, it can provide a benchmark to determine whether or not thelearning of violators is tracked. As a result, the administrator 5 canconsider revising the learning period and the learning method, and takemeasures to proactively prevent the transmission of risky mails.

Moreover, the mail server 10 can feed back the classification result foreach mail address, thereby enabling enhancement in the moral of theemployees and enabling evaluation of the morale of the employees.

[c] Third Embodiment

Meanwhile, although the present invention has been described withreference to the abovementioned embodiments, it is also possible toimplement the invention in various forms other than the abovementionedembodiments.

Numerical Values, Classification

The category classification count, the category names, the number ofdivisions of the degree of risk, and the determination criteria for thedegree of risk explained in the embodiments can be changed in anarbitrary manner. Moreover, although line graphs and pie charts areillustrated in the second embodiment, those are not the only possiblegraphs. Alternatively, it is possible to use bar graphs or other typesof graphs. Furthermore, excluded keywords and impermissible keywords canbe set in common among all categories.

System

The constituent elements of the device illustrated in FIGS. 2 and 11 aremerely conceptual, and need not be physically configured as illustrated.The constituent elements can be separated or integrated in arbitraryunits. For example, the learning unit 24 and the risk degree determiningunit 30 can be integrated together. Moreover, the process functionsperformed by the device can be entirely or partially realized by acentral processing unit (CPU) or computer programs that are analyzed andexecuted by the CPU, or can be realized as hardware by wired logic.

Furthermore, of the processes described in the embodiments, all or partof the processes explained as being performed automatically can beperformed manually. Similarly, all or part of the processes explained asbeing performed manually can be performed automatically by a knownmethod. Furthermore, processing procedures, control procedures, specificnames, and the information including various types of data andparameters as described in the above specifications and the drawings maybe optionally changed except as otherwise noted.

Hardware

For example, the mail server 10 can be implemented using a computerhaving the following hardware configuration. FIG. 20 is a diagram forexplaining an exemplary hardware configuration. As illustrated in FIG.20, the mail server 10 includes a communication interface 10 a, a harddisk drive (HDD) 10 b, a memory 10 c, and a processor 10 d.

Examples of the communication interface 10 a includes a networkinterface. The HDD 10 b is a memory device used in storing the variousdatabases illustrated in FIG. 2.

Examples of the memory 10 c include a random access memory (RAM) such asa synchronous dynamic random access memory (SDRAM); a read only memory(ROM); or a flash memory. Examples of the processor 10 d include a CPU,a digital signal processor (DSP), a field programmable gate array(FPGA), and a programmable logic device (PLD).

The mail server 10 operates as an information processing device thatreads and executes a computer program and implements the learningmethod. Thus, the mail server 10 executes a computer program thatimplements functions identical to the receiving unit 21, theclassification determining unit 22, the sending unit 23, the learningunit 24, the risk degree determining unit 30, and the display controlunit 31. As a result, the mail server 10 can execute processes thatimplement functions identical to the receiving unit 21, theclassification determining unit 22, the sending unit 23, the learningunit 24, the risk degree determining unit 30, and the display controlunit 31. Meanwhile, the computer program mentioned herein is not limitedto the computer program executed by the mail server. For example, evenin the case in which another computer or another server executes thecomputer program or in the case in which the computers and serversexecute the computer program in cooperation, the invention can beimplemented in an identical manner.

The computer program can be distributed via a network such as theInternet. Alternatively, the computer program can be recorded in acomputer-readable recording medium such as a hard disk, a flexible disk(FD), a compact disk read only memory (CD-ROM), a magneto-optical (MO)disk, or a digital versatile disk (DVD). The computer can read thecomputer program from the recording medium and execute it.

According to one aspect of the embodiment, it becomes possible tounderstand the transmission status of the electronic mails that causecompliance violation.

All examples and conditional language recited herein are intended forpedagogical purposes of aiding the reader in understanding the inventionand the concepts contributed by the inventor to further the art, and arenot to be construed as limitations to such specifically recited examplesand conditions, nor does the organization of such examples in thespecification relate to a showing of the superiority and inferiority ofthe invention. Although the embodiments of the present invention havebeen described in detail, it should be understood that the variouschanges, substitutions, and alterations could be made hereto withoutdeparting from the spirit and scope of the invention.

What is claimed is:
 1. A non-transitory computer-readable recordingmedium having stored therein a display control program that causes acomputer to execute a process comprising: receiving a mail from a sourceaddress; first determining whether the mail received is an inappropriatemail by second determining whether the mail matches with an extractioncondition for inappropriate mails, and storing in a storage unit aresult of the first determining with the source address, a destinationaddress to which the mail is addressed, or a pair of the source addressand the destination address; receiving an instruction to display riskdegree status from a user; displaying a list of source addresses ofinappropriate mails that are determined as the inappropriate mail, asource address among the source addresses in the list being classifiedinto a level according to transition of a rate of receivinginappropriate mails from the source address, based on information storedin the storage unit; receiving a selection of a source address in thelist from the user; displaying as a graph the transition of the rate ofreceiving inappropriate mails from the selected source address, based onthe information stored in the storage unit, and displaying in the graphan updating timing that indicates that the extraction condition isupdated; and generating a mail addressed to the selected source address,body text thereof being created according to a level into which theselected source address is classified.
 2. The non-transitorycomputer-readable recording medium according to claim 1, wherein thedisplaying the list includes displaying a list of destination addressesto which inappropriate mails are transmitted, a destination addressamong the destination addresses in the list being classified into alevel according to a rate of inappropriate mails being transmitted tothe destination address, or displaying a list of pairs of a sourceaddress and a destination address, a pair being classified into a levelaccording to a rate of inappropriate mails being transmitted from thesource address to the destination address.
 3. The non-transitorycomputer-readable recording medium according to claim 1, wherein thedisplaying the transition includes displaying the extraction conditionor body text of an inappropriate mail matching with the extractioncondition for the selected source address.
 4. The non-transitorycomputer-readable recording medium according to claim 1, wherein thedisplaying the transition includes generating a mail addressed to theselected source address.
 5. A display control method comprising:receiving a mail from a source address, using a processor; firstdetermining whether the mail received is an inappropriate mail by seconddetermining whether the mail matches with an extraction condition forinappropriate mails, and storing in a storage unit a result of the firstdetermining with the source address, a destination address to which themail is addressed, or a pair of the source address and the destinationaddress, using the processor; receiving an instruction to display riskdegree status from a user, using the processor; displaying a list ofsource addresses of inappropriate mails that are determined as theinappropriate mail, a source address among the source addresses in thelist being classified into a level according to transition of a rate ofreceiving inappropriate mails from the source address, based oninformation stored in the storage unit, using the processor; receiving aselection of a source address in the list from the user, using theprocessor; displaying as a graph the transition of the rate of receivinginappropriate mails from the selected source address, based on theinformation stored in the storage unit, and displaying in the graph anupdating timing that indicates that the extraction condition is updated,using the processor; and generating a mail addressed to the selectedsource address, body text thereof being created according to a levelinto which the selected source address is classified, using theprocessor.
 6. An information processing device comprising: a processorthat executes a process including: receiving a mail from a sourceaddress; first determining whether the mail received is an inappropriatemail by second determining whether the mail matches with an extractioncondition for inappropriate mails, and storing in a storage unit aresult of the first determining with the source address, a destinationaddress to which the mail is addressed, or a pair of the source addressand the destination address; receiving an instruction to display riskdegree status from a user; displaying a list of source addresses ofinappropriate mails that are determined as the inappropriate mail, asource address among the source addresses in the list being classifiedinto a level according to transition of a rate of receivinginappropriate mails from the source address, based on information storedin the storage unit; receiving a selection of a source address in thelist from the user; displaying as a graph the transition of the rate ofreceiving inappropriate mails from the selected source address, based onthe information stored in the storage unit, and displaying in the graphan updating timing that indicates that the extraction condition isupdated; and generating a mail addressed to the selected source address,body text thereof being created according to a level into which theselected source address is classified.